CVE-2026-31457
EUVD-2026-2479622.04.2026, 14:16
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs: check contexts->nr in repeat_call_fn
damon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(),
damon_sysfs_upd_schemes_stats(), and
damon_sysfs_upd_schemes_effective_quotas() without checking contexts->nr.
If nr_contexts is set to 0 via sysfs while DAMON is running, these
functions dereference contexts_arr[0] and cause a NULL pointer
dereference. Add the missing check.
For example, the issue can be reproduced using DAMON sysfs interface and
DAMON user-space tool (damo) [1] like below.
$ sudo damo start --refresh_interval 1s
$ echo 0 | sudo tee \
/sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contextsEnginsightAffected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 6.17 ≤ 𝑥 < 6.18.21 |
| linux | linux_kernel | 6.19 ≤ 𝑥 < 6.19.11 |
| linux | linux_kernel | 7.0:rc1 |
| linux | linux_kernel | 7.0:rc2 |
| linux | linux_kernel | 7.0:rc3 |
| linux | linux_kernel | 7.0:rc4 |
| linux | linux_kernel | 7.0:rc5 |
𝑥
= Vulnerable software versions
Debian Releases
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| bpftool6.18 |
| ||
| bpftool6.18-debuginfo |
| ||
| kernel-livepatch-6.18.25-52.107 |
| ||
| kernel6.18 |
| ||
| kernel6.18-debuginfo |
| ||
| kernel6.18-debuginfo-common-aarch64 |
| ||
| kernel6.18-debuginfo-common-x86_64 |
| ||
| kernel6.18-devel |
| ||
| kernel6.18-headers |
| ||
| kernel6.18-modules-extra |
| ||
| kernel6.18-modules-extra-common |
| ||
| kernel6.18-tools |
| ||
| kernel6.18-tools-debuginfo |
| ||
| kernel6.18-tools-devel |
| ||
| perf6.18 |
| ||
| perf6.18-debuginfo |
| ||
| python3-perf6.18 |
| ||
| python3-perf6.18-debuginfo |
|
Common Weakness Enumeration